Stolen Claude API keys can turn Claude Code into a remote-controlled implant Help Net Security